Patch 1 fixes a use-after-free of the LLC queue entry in
smc_llc_srv_add_link(), patch 2 bounds the peer's rkey counts, and patch 3
carries the tail of an oversized v2 message in the queue entry so that both
readers are bounded by what arrived. All three are tagged for stable: a
tree that takes 1 and 2 without 3 still deletes rkeys read from whatever an
earlier message left in the shared receive buffer.
Changes since v5:
- 1/3: leave through the existing exit label instead of repeating the two
kfree()s (Breno Leitao). The object code is unchanged.
- 3/3: add the Fixes: and Cc: stable tags (Simon Horman).
- 3/3: assert that the two DELETE_RKEY_V2 layouts agree on the offset of
rkey[], since the parsing code indexes one and the existing assert
constrains the other.
- 3/3: limit the copied tail to the largest one either reader can use,
so the size of the queue entry is not chosen by the peer.
- 3/3: the comment in smc_wr_init_sge() described the memcpy() this patch
removes; correct it.
Yehyeong Lee (3):
net/smc: fix use-after-free of the LLC qentry in
smc_llc_srv_add_link()
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
---
v5:
https://lore.kernel.org/netdev/[email protected]/
net/smc/smc_llc.c | 122 ++++++++++++++++++++++++++++++++++++----------
net/smc/smc_wr.c | 6 +--
2 files changed, 98 insertions(+), 30 deletions(-)
--
2.43.0
